Cilium-Associate Questions and Answers

Technical explanation

Cilium derives a workload’s security identity from its security-relevant labels. Network policies then refer to workload characteristics such as application, role, environment, namespace, or service account rather than depending exclusively on transient pod IP addresses. The identity is associated with traffic in the Cilium datapath and validated when policy is enforced. This makes B the accurate description.

The identity is not limited to a single pod. Endpoints that have the same set of identity-relevant labels can share the same numeric security identity, including endpoints located on different cluster nodes. This reduces policy-map growth and allows policy to scale with logical application groups rather than with the number of pod addresses. Namespace information is normally among the labels used to derive identity, but that does not make an identity inherently “tied to a single namespace” as option A states.

Options C and D invert Cilium’s design. IP addresses remain necessary for packet delivery, but they are not the primary security identifier for Cilium-managed workloads. Pods can be recreated and assigned new addresses while retaining the same relevant labels and therefore the same security intent. Decoupling identity from addressing is precisely what improves scalability and operational stability.

Official references

Cilium Terminology and Identity ; Introduction to Cilium and Hubble .

Study Guide topic: Architecture.

Technical explanation

Both Kubernetes Ingress and the north-south use of Gateway API provide declarative Layer 7 routing from clients outside the cluster to Kubernetes workloads. They express host- and path-based routing through Kubernetes resources and can be implemented by controllers such as Cilium’s Envoy-based ingress implementation. A therefore captures their shared purpose most accurately.

The remaining choices describe differences rather than universal similarities. Gateway API is explicitly role-oriented: infrastructure administrators manage GatewayClass and often Gateway , while application owners manage route resources such as HTTPRoute . The Ingress API does not provide the same formal separation of administrative and application-facing resources, making C unsuitable as a statement about both.

Implementation-specific annotations are historically common with Ingress because its core API is limited. Gateway API was deliberately designed with more expressive, portable resource fields so that implementations do not need to depend as heavily on vendor-specific annotations; D is consequently not true of both. Namespace behavior also differs because Gateway API provides controlled cross-namespace attachment and reference mechanisms. B is therefore not the defining common capability.

Official references

Cilium Kubernetes Ingress Support , Cilium Gateway API Support , Migrating from Ingress to Gateway API

Study Guide topic: Kubernetes north-south routing, Ingress, and Gateway API.

Technical explanation

A cluster-wide requirement is best implemented with CiliumClusterwideNetworkPolicy , whose correct resource spelling is CiliumClusterwideNetworkPolicy . Unlike a namespaced CiliumNetworkPolicy , this Cilium CRD is non-namespaced and can select endpoints across the entire cluster.

To deny external ingress for every Cilium-managed pod, a cluster-wide policy can use an empty endpointSelector and an ingressDeny rule selecting the world entity. Cilium defines world as network endpoints outside the cluster. An alternative allow-list construction can permit only the cluster entity, thereby excluding external sources, but an explicit deny rule usually communicates the requirement more directly.

A standard Kubernetes NetworkPolicy and a CiliumNetworkPolicy are namespaced, requiring repeated resources in every applicable namespace. CiliumGlobalPolicy is not a valid Cilium resource type. Although the option capitalizes “Wide” differently from the actual kind, D unmistakably identifies the intended cluster-scoped policy.

Official references

Cilium Deny Policies , Cilium Network Policy Types

Study Guide topic: Cluster-scoped policies, external traffic, and reserved entities.

Technical explanation

cilium config set debug true follows the supported Cilium CLI configuration syntax and sets the debug configuration key to true . The cilium config set command accepts a key/value pair and, by default, restarts the Cilium pods so that the changed configuration is applied. The Cilium configuration documentation defines debug as the setting that enables full debug mode. This increases agent logging verbosity and causes eBPF programs to emit additional visibility events for diagnostic use.

Options A, B, and D do not match documented Cilium CLI command structures. There is no cilium log level --set=debug command in the Cilium CLI hierarchy, and neither cilium logging.level=debug nor cilium logging debug is valid configuration syntax. A Helm-managed installation may also enable debugging through the chart value debug.enabled=true , but that does not make any of the alternative commands correct.

Debug mode should be enabled deliberately because it increases log volume and may generate additional datapath visibility information. After troubleshooting, operators should normally restore the previous setting to avoid unnecessary operational overhead.

The supplied answer key incorrectly identifies B. The verified answer is C.

Official references

Cilium configuration ; Cilium CLI `config set` ; Helm values .

Study Guide topic: Installation and Configuration.

Technical explanation

Option B correctly represents the Ingress as a Gateway and an attached HTTPRoute . The Gateway is named cilium , uses gatewayClassName: cilium , and exposes an HTTP listener on port 80. The HTTPRoute uses parentRefs with the same Gateway name, cilium , so the route attaches to the declared listener. Its two rules preserve the original routing behavior: /details with PathPrefix targets the details Service on port 9080, while / with PathPrefix targets productpage on port 9080.

Option A declares a Gateway named cilium but attaches its route to nginx-gateway . Because the parent reference does not identify the displayed Gateway, it is not equivalent. Options C and D use kind: Route ; the correct resource kind for HTTP path routing is HTTPRoute . They also contain malformed or altered backend and matching fields. Option D changes the details backend name, while option C contains incorrect route structure and path content.

Cilium’s official migration example uses the same conversion pattern: the Ingress class becomes the Gateway’s class, paths move into HTTPRoute.rules , and the route identifies its Gateway through parentRefs .

The supplied key incorrectly identifies A. The verified answer is B.

Official references

HTTP Migration Example .

Study Guide topic: Service Mesh.

Technical explanation

In Cilium’s default policy-enforcement mode, an endpoint initially permits ingress and egress traffic. Enforcement changes independently for each direction when a policy selects that endpoint. If a selecting rule contains an ingress section, the endpoint enters default-deny mode for ingress. If a selecting rule contains an egress section, it enters default-deny mode for egress. Only traffic explicitly permitted by the applicable policy rules remains allowed in the restricted direction.

This per-direction behavior is important. An ingress-only policy does not automatically restrict egress, and an egress-only policy does not automatically restrict ingress. Options A and B reverse the relationship between the rule section and the direction being enforced. Option C incorrectly states that selection places the endpoint into default-allow mode; default allow describes the endpoint’s condition before it is selected by an enforcing policy.

Cilium also supports always and never enforcement modes. In always , enforcement applies even to endpoints not selected by policy. In never , policy enforcement is disabled. Policies can additionally use enableDefaultDeny for specialized visibility configurations, but those controls do not change the normal default behavior described in the question.

Official references

Policy Enforcement Modes .

Study Guide topic: Network Policy.

Technical explanation

Hubble UI and Hubble CLI are Cilium’s integrated interfaces for examining workload network flows. Hubble records source and destination identities, namespaces, workloads, addresses, ports, forwarding verdicts, and drop reasons. When Layer 7 visibility is configured, its flow output can also contain application-level information such as HTTP methods, URLs, response codes, latency, and DNS queries. Filters can narrow the results by source workload, namespace, destination, protocol, port, or verdict, making Hubble appropriate for investigating egress behavior.

Hubble CLI provides detailed event-oriented inspection, while Hubble UI presents flows and service dependencies graphically. Hubble Relay aggregates the per-node Hubble APIs so these clients can obtain cluster-wide visibility.

Load balancing directs traffic but is not an observability interface. Kubernetes NetworkPolicy expresses permitted communications but does not by itself display application-level flow records. Fluentd and Grafana are external logging and visualization components and would violate the requirement to avoid additional tooling.

Layer 7 information requires supported traffic to be redirected through Cilium’s L7 proxy. Hubble then exposes the resulting application-layer flow events through the built-in CLI or UI, making D the complete answer.

Official references

Network Observability with Hubble ; Inspecting Network Flows .

Study Guide topic: Network Observability.

Technical explanation

The question’s “12 Announcements” wording is a source transcription error for L2 Announcements . This feature makes Kubernetes Services visible and reachable to clients on the local Layer 2 network, particularly in on-premises, office, campus, or bare-metal environments that do not use BGP-based service advertisement.

Cilium responds to ARP requests for IPv4 Service addresses and NDP requests for IPv6 addresses. A selected node advertises the LoadBalancer IP or ExternalIP using its MAC address and receives traffic for that virtual IP. Cilium then applies its service load-balancing functionality to forward the connection to an appropriate backend. Leadership is coordinated so that one node advertises a given Service at a time, and the virtual IP can move to another eligible node after failure.

The feature is not intended to provide general Layer 2 multicast, making A incorrect. DNS service discovery is handled through Kubernetes DNS and is independent of L2 announcements, eliminating C. It also does not define Layer 2 security policies, so D is incorrect.

Thus, the purpose is external Service reachability on the local area network, exactly as described by B.

Official references

L2 Announcements .

Study Guide topic: BGP and External Networking.

Technical explanation

Cilium uses Envoy as its userspace Layer 7 proxy. When a Cilium policy contains HTTP or another supported application-layer rule, Cilium’s eBPF datapath identifies matching traffic and redirects it to a node-local Envoy instance. Envoy evaluates the application-layer attributes—such as HTTP method, path, or headers—against the generated policy configuration and then forwards or rejects the request.

The proxy can operate in embedded mode as a separate process inside the Cilium agent pod or as the independently life-cycled cilium-envoy DaemonSet. Both deployment forms use Cilium’s optimized Envoy distribution and custom policy-enforcement filters. Communication between the agent and Envoy uses local UNIX-domain sockets for configuration, access logs, and administrative operations.

HAProxy is a capable general-purpose load balancer, but it is not Cilium’s L7 policy proxy. Squid primarily serves forward and caching proxy use cases. linkerd2-proxy belongs to the Linkerd service mesh and is not used by Cilium for network-policy enforcement. Consequently, only D identifies the proxy integrated into Cilium’s L7 datapath.

Official references

Cilium Envoy , Cilium eBPF Datapath Introduction

Study Guide topic: Envoy proxy integration and Layer 7 policy enforcement.

Technical explanation

Cilium derives an endpoint’s security identity from its security-relevant labels rather than from its current IP address. When multiple endpoints possess the same relevant label set, they receive and share the same numeric security identity. This enables policies to follow an application as pods are recreated, rescheduled, or scaled across nodes.

In Kubernetes, the Cilium agent obtains workload metadata through the Kubernetes API and associates the pod’s labels with the corresponding Cilium endpoint. Identity allocation converts the relevant label set into a cluster-wide identity. Policy enforcement then matches that identity in the eBPF datapath instead of depending exclusively on short-lived pod addresses.

Option A incorrectly makes the IP address the source of identity and says that identities cannot be shared. Option B incorrectly identifies annotations as the identity foundation. Annotations may configure behavior, but Cilium’s security model is label-based. Option D is also incorrect because operators do not ordinarily assign each pod’s numeric security identity manually. Identity allocation and lifecycle management are automatic.

Official references

Cilium Terminology and Identities , Limiting Identity-Relevant Labels

Study Guide topic: Label-derived identities and identity-based policy enforcement.

Technical explanation

A is a supported recommendation: Cilium’s WireGuard implementation provides transparent encryption between Cilium-managed endpoints, works with Cluster Mesh, and distributes node public keys to remote clusters through clustermesh-apiserver . All participating clusters must enable WireGuard, and inter-cluster firewalls must permit UDP port 51871. IPv6-only pod traffic does not inherently disqualify WireGuard.

However, this question is no longer uniquely answerable from current Cilium documentation. Current IPsec documentation supports IPv6 pod-to-pod connectivity and sets its cluster or Cluster Mesh limit at more than 65,535 nodes. The described mesh contains 10,002 nodes, so option B is also technically supportable under the stated facts. The older distinction apparently assumed by the supplied key is no longer sufficient to exclude IPsec.

Options C and D are definitively false. Ten thousand and two nodes remain below the documented IPsec ceiling, and transparent encryption is not restricted to IPv4. WireGuard may still be selected for its automatic per-node key-pair distribution and simpler Cluster Mesh integration, but workload performance, kernel support, firewall rules, key-management requirements, and operational testing should inform a production recommendation.

Official references

WireGuard Transparent Encryption , IPsec Transparent Encryption

Study Guide topic: Transparent-encryption selection, IPv6, Cluster Mesh, and scaling limits.

Technical explanation

The exhibit records connections originating from default/test and directed to default/test2 , eliminating B and C because those choices reverse the initiating workload. For destination port 80, the flow shows the TCP three-way handshake—SYN, SYN-ACK, and ACK—followed by bidirectional packets with ACK/PSH flags and an orderly FIN exchange. This is the pattern of a successfully established request and response, so the first curl operation succeeded.

The later connection targets port 8080. Hubble records a SYN from test followed by an ACK, RST response from test2 . A reset returned immediately after the connection attempt indicates that the destination rejected or could not accept the connection, commonly because no process was listening on that port. It is not shown as a policy drop; both entries carry the FORWARDED verdict. Thus the network delivered the packets, but the TCP connection itself failed.

Option D is the only choice matching a successful request from test to port 80 and a failed request from test to port 8080. Its displayed IP strings contain source-document transcription defects, but its workload direction, ports, and outcomes match the exhibit.

Official references

Inspecting Network Flows with the CLI ; Troubleshooting with Hubble .

Study Guide topic: Network Observability.

Technical explanation

Option C has the correct Cilium policy structure. It selects pods labeled app: frontend , creates an egress rule with a valid CIDR entry, and combines that destination constraint with toPorts , port 8888 , and protocol TCP . Because the CIDR and port restriction are in the same egress rule, traffic must meet both conditions.

Option A uses an unsupported address-range structure with from and to fields rather than CIDR notation. Option B initially resembles the correct form but contains an additional malformed ports item at the egress-rule level. Option D uses unsupported action: allow and action: deny fields inside toPorts ; Cilium allow and deny behavior is expressed through policy sections such as egress and egressDeny , not per-port action properties.

The item is nevertheless defective. The prose and examples indicate 192.168.9.0/24 , while all displayed CIDR-based options specify 192.168.0.0/24 ; the source text itself shows the corrupted 192.168.e.e/24 . If 192.168.9.0/24 is authoritative, none of the exhibits permits the stated example. The supplied key B is structurally incorrect under the displayed manifests.

Official references

Cilium Layer 3 and CIDR Policies

Study Guide topic: CIDR selectors, Layer 4 ports, and rule composition.